Skip to content
Heist/ feed
HighFix available

Contrast's unauthenticated recovery allows Coordinator impersonation

Type: advisorySource: OSV1 source record

### Impact Recovering coordinators do not verify the seed provided by the recovering party. This allows an attacker to set up a coordinator with a manifest that passes validation, but with a secret seed controlled by the attacker. If network traffic is redirected from the legitimate coordinator to the attacker's coordinator, a workload owner is susceptible to impersonation if either * they `set` a new manifest and don't compare the root CA cert with the existing one (this is the default of the `contrast` CLI) or * they `verify` the coordinator and don't compare the root CA cert with a trusted reference. Under these circumstances, the attacker can: * Issue certificates that chain back to the attacker coordinator's root CA. * Recover arbitrary workload secrets of workloads deployed after the attack. This issue does **not** affect the following: * secrets of the legitimate coordinator (seed, workload secrets, CA) * integrity of workloads, even when used with the rogue coordinator * certificates chaining back to the mesh CA ### Patches This issue is patched in Contrast v1.4.1. ### Workarounds The issue can be avoided by verifying the coordinator root CA cert against expectations. * At the first `set` call, keep a copy of the CA cert returned by the coordinator. * After subsequent `set` or `verify` calls, compare the returned CA cert with the backup copy. If it matches bit-for-bit, the coordinator is legitimate.

Announced Source revision 1
Original source ↗

GHSA-vqv5-385r-2hf8

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-vqv5-385r-2hf8

github.com/edgelesssys/contrast

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.4.1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.4.1"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/edgelesssys/contrast",
      "purl": "pkg:golang/github.com/edgelesssys/contrast",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-vqv5-385r-2hf8/GHSA-vqv5-385r-2hf8.json",
      "last_known_affected_version_range": "<= 1.4.0"
    }
  }
]
Related CVEs
CVE-2025-71426

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2025-71426 · High

contrast

Event
#19715 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement